document.all seems leaked directly to the iframe

[mmis1000]

Because document.all == null

https://github.com/caridy/secure-javascript-environment/blob/6032355e5d26f70effa7cdb3cf6db2e051d81c54/src/secure-value.ts#L111

This line is incorrect because it will include document.all

[Caridy Patiño]

Oh wow, that’s unexpected:

document.all == null
> true
document.all.length
> 1352

I wonder why, and what other APIs are implementing a similar magical behavior.

As for the fix, it should be an easy one.

[Caridy Patiño]

once again @mmis1000, thanks for the help here, you rock!